Authorizer
Monthly
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.
Unauthenticated privilege escalation in the WordPress Authorizer plugin (versions 3.15.1 and earlier) lets remote attackers with no credentials elevate themselves to elevated/administrative roles, according to a CVSS 9.8 rating and CWE-266 (incorrect privilege assignment). Authorizer is an authentication/SSO plugin, so a flaw in its role-assignment logic effectively hands attackers control of the authentication gate itself. No public exploit identified at time of analysis, and the issue is reported by Patchstack rather than listed in CISA KEV.